187
CVEs
71
Critical
68
High
0
KEV
10
PoC
37
Unpatched C/H
74.9%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
71
HIGH
68
MEDIUM
47
LOW
0
Monthly CVE Trend
Affected Products (30)
Firefox
1621
Thunderbird
1007
Firefox Esr
462
Ubuntu Linux
371
Opensuse
325
Seamonkey
317
Android
288
Debian Linux
268
Thunderbird Esr
226
Enterprise Linux Workstation
169
Enterprise Linux Desktop
169
Enterprise Linux Server
168
Linux Enterprise Desktop
127
Linux Enterprise Server
126
Enterprise Linux Eus
116
Leap
110
Enterprise Linux Server Aus
105
Linux Enterprise Software Development Kit
102
Enterprise Linux Server Eus
95
Fedora
77
Enterprise Linux Server Tus
70
Solaris
68
Suse Linux Enterprise Server
56
Chrome
51
Suse Linux Enterprise Desktop
45
Suse Linux Enterprise Software Development Kit
45
Open Redirect
33
Network Security Services
33
Bugzilla
31
Linux Enterprise
20
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-69253 | Authenticated remote code execution in FlowiseAI Flowise (versions ≤ 3.1.2, npm packages flowise and flowise-components) arises from a vm2 JavaScript sandbox escape reachable through the AgentAsTool, ChatflowTool, and ExecuteFlow nodes, which still run untrusted code in the deprecated in-process vm2 sandbox (useSandbox: false). An attacker who can edit a chatflow injects code via an unvalidated baseURL URL-hash fragment and abuses moment's CVE-2022-24785 path-traversal (whose fix is bypassable inside the sandbox) to break out of vm2 and run arbitrary commands as the Flowise service account, fully compromising the host. A complete working exploit is published in the elttam/GitHub advisory, but the flaw is not in CISA KEV. | CRITICAL | 9.0 | 0.3% | 65 |
PoC
|
| CVE-2026-70473 | Broken access control in Flowise's GET /api/v1/upsert-history API endpoint exposes the entire server-wide upsert history - exceeding 100MB per response - to any authenticated user, leaking sensitive infrastructure credentials including Qdrant server URLs, collection names, and vector pipeline configuration across all tenants and workspaces. The vulnerability is confirmed in flowise <= 3.1.2 and publicly documented in GHSA-fr6g-7cq8-fg82 with a working curl-based proof-of-concept, meaning any account holder on a multi-tenant deployment can harvest cross-tenant vector store configuration for reconnaissance or targeted follow-on attacks against exposed backends. Vendor-released patch flowise@3.1.3 is confirmed available and addresses missing workspace-scoping enforcement across multiple API controllers. | HIGH | 8.3 | 0.2% | 62 |
PoC
|
| CVE-2026-59931 | Server-side request forgery in PHPOffice PhpSpreadsheet (>= 4.0.0 through 5.8.0, plus older branches back to 2.0.0) lets an attacker bypass the WEBSERVICE() domain whitelist introduced in 5.4.0 by chaining through an HTTP 302/301 redirect. Because the whitelist only validates the initial URL host while file_get_contents() silently follows redirects without re-validation, an attacker who can upload a crafted XLSX to an app that calls setDomainWhiteList() and getCalculatedValue() can pivot to internal-only targets and read the full HTTP response (up to 32,767 bytes) as a cell value. Publicly available exploit code exists (a full PoC and lab reproduction are in the GitHub advisory); no public exploit identified as actively used in the wild and it is not in CISA KEV. | HIGH | 7.7 | 0.5% | 59 |
PoC
|
| CVE-2026-53553 | Path traversal in Goploy's `/deploy/fileDiff` endpoint (versions <=1.17.5) enables any authenticated low-privilege member to read arbitrary files on both the Goploy host and every SFTP-managed remote server registered in the system. The dual file read returns local content in the `srcText` response field and remote server content in `distText`, multiplying the blast radius across all managed deployment targets. Publicly available exploit code exists per the GitHub Security Advisory; this is not listed in CISA KEV, but exploitation conditions are trivially met under default Goploy configuration. | HIGH | 7.7 | 0.3% | 59 |
PoC
|
| CVE-2026-90648 | Sandbox escape in wasm2c (wabt ≤ 1.0.41) allows an attacker controlling WebAssembly content to achieve arbitrary read/write of host process memory and code execution by exploiting an unchecked calloc() return value during funcref table allocation. When calloc() fails, table->data is left NULL while table->size retains the guest-declared element count, causing bounds checks to pass and element accesses to resolve to absolute low-memory addresses - fully defeating the isolation wasm2c exists to provide. Firefox's RLBox sandboxing of Graphite, Hunspell, Ogg, Expat, and Woff2 libraries is affected, and a public proof-of-concept ('table flip') is available, though exploitation requires specific memory-failure conditions to be present. | HIGH | 7.1 | 0.1% | 56 |
PoC
No patch
|
| CVE-2026-55593 | Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
|
| CVE-2026-59941 | Uncontrolled resource consumption in dompdf's BMP image processing pipeline allows any unauthenticated attacker who can submit HTML to a dompdf-powered endpoint to exhaust server memory and stall PHP-FPM worker pools with a 169-byte HTTP request. The library trusts attacker-controlled BMP header dimensions without bounding width × height, causing PHP's GD extension to allocate a full native pixel canvas - bypassing PHP's memory_limit entirely because GD allocates through its own native allocator. A publicly available, verified proof-of-concept demonstrates ~12× memory amplification (34 MB control vs ~412 MB attack peak RSS) from identically-sized requests, making this a high-impact, low-effort denial-of-service primitive. No active exploitation confirmed in CISA KEV at time of analysis. | MEDIUM | 6.3 | 0.5% | 52 |
PoC
|
| CVE-2026-75874 | Sandbox escape in the Remote Settings Client component of Mozilla Firefox lets attacker-controlled code break out of the isolated content process and reach the more privileged parent process, and was resolved in Firefox 154. The flaw is classed as a protection-mechanism failure (CWE-693) and carries a maximal CVSS 3.1 base score of 10.0 with a changed scope, reflecting cross-boundary impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a high-severity but not yet actively-exploited issue. | CRITICAL | 10.0 | 0.4% | 50 |
|
| CVE-2026-16367 | Sandbox escape in Mozilla Firefox before version 153 stems from an invalid pointer (CWE-119 memory-safety error) in the Disability Access (accessibility) APIs component, letting an attacker who can execute code in a constrained content process break out of the browser sandbox and reach the more privileged parent process with full confidentiality, integrity, and availability impact (CVSS 10.0, scope-changed). No public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile), indicating no evidence of widespread exploitation despite the maximum CVSS score. | CRITICAL | 10.0 | 0.1% | 50 |
No patch
|
| CVE-2026-74990 | Memory-corruption defects in Mozilla Firefox and its ESR channels allow potential arbitrary code execution when a user renders attacker-controlled web content, per Mozilla advisories MFSA2026-74 through MFSA2026-80. The flaws were found internally by Mozilla across Firefox 153 and ESR 115.38/140.13/153.0, and Mozilla states some showed evidence of memory corruption that could plausibly be exploited. No public exploit identified at time of analysis; the issues are already fixed in Firefox 154, ESR 115.39, 140.14, and 153.1. | CRITICAL | 9.8 | 0.6% | 50 |
|
| CVE-2026-74979 | Access-control mitigation bypass in the Firefox Add-ons Manager component allows attackers to circumvent a security protection that Mozilla had previously put in place around add-on handling, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla assigned this a 9.8 CVSS score with a fully remote, unauthenticated, no-user-interaction vector, though the terse advisory text does not detail the exact protection defeated. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-16411 | Memory corruption in Mozilla Firefox 152 lets a remote attacker who lures a victim to a malicious web page trigger memory-safety violations that Mozilla assesses could be leveraged for arbitrary code execution. The flaw is one of a batch of internally-discovered memory safety bugs (CWE-119) rolled up under MFSA2026-68 and carries a CVSS 9.8 rating; there is no public exploit identified at time of analysis, and it is fixed in Firefox 153. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-16412 | Memory corruption in Mozilla Firefox 152 and Firefox ESR 140.12 could allow attackers to run arbitrary code within the browser, per Mozilla advisories MFSA2026-68 and MFSA2026-70. The flaw is a batch of internally-discovered memory safety bugs (CWE-119) affecting the Firefox rendering/JavaScript engine, at least some of which showed evidence of exploitable memory corruption. No public exploit identified at time of analysis; the issues were reported by Mozilla itself and fixed in Firefox 153 and Firefox ESR 140.13. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-16361 | Memory-corruption in Mozilla Firefox ESR 115.37 and 140.12 could allow attackers to run arbitrary code by triggering memory-safety bugs (CWE-119) that Mozilla observed showing evidence of memory corruption. Reported by Mozilla and tracked under advisories MFSA2026-69/70, the flaw is remotely reachable and carries a CVSS 9.8, though there is no public exploit identified at time of analysis and no active-exploitation (KEV) listing. Mozilla explicitly frames exploitation as presumptive ('with enough effort'), indicating no confirmed working exploit. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-16395 | Memory-corruption via an integer overflow in Mozilla Firefox's Audio/Video component allows remote attackers to compromise the browser when a victim processes attacker-controlled media, with the CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicating unauthenticated network exploitation and high impact to confidentiality, integrity, and availability. The flaw was fixed in Firefox 153 per Mozilla advisory MFSA2026-68. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|